Description
.NET and Visual Studio Elevation of Privilege Vulnerability
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | .NET Core 3.1 | 3.1 – < 3.1.15-servicing.21214.3 | 3.1.15-servicing.21214.3 |
| Microsoft | .NET 5.0 | 5.0.0 – < 5.0.6-servicing.21220.11 | 5.0.6-servicing.21220.11 |
| Microsoft | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | 15.0.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | 16.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | 16.0.0 – < publication | publication |
| Microsoft | Visual Studio 2019 for Mac version 8.9 | 8.0 – < publication | publication |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | dotnet +4 | 5.0.203-1.el8_4 | RHSA-2021:2036 |
| RHEL 8 | dotnet-host +6 | 5.0.6-1.el8_4 | RHSA-2021:2036 |
| RHEL 8 | dotnet-hostfxr-3.1 +5 | 3.1.15-1.el8_4 | RHSA-2021:2037 |
| RHEL 8 | dotnet3.1 +2 | 3.1.115-1.el8_4 | RHSA-2021:2037 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 5 | rh-dotnet50-dotnet +3 | 5.0.203-1.el7_9 | RHSA-2021:1546 |
| Red Hat Rhel Dotnet 5 | rh-dotnet50-dotnet-host +6 | 5.0.6-1.el7_9 | RHSA-2021:1546 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet +3 | 3.1.115-1.el7_9 | RHSA-2021:1547 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet-host +6 | 3.1.15-1.el7_9 | RHSA-2021:1547 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | dotnet +3 | 5.0.203-1.0.1.el8_4 | ELSA-2021-2036 |
| Oracle Linux 8 | dotnet-host +6 | 5.0.6-1.0.1.el8_4 | ELSA-2021-2036 |
| Oracle Linux 8 | dotnet-hostfxr-3.1 +5 | 3.1.15-1.0.1.el8_4 | ELSA-2021-2037 |
| Oracle Linux 8 | dotnet-sdk-3.1 +1 | 3.1.115-1.0.1.el8_4 | ELSA-2021-2037 |
Advisories 6
- RHSA-2021:2036 Red Hat Security Advisory: dotnet5.0 security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2021:2037 Red Hat Security Advisory: dotnet3.1 security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2021:1546 Red Hat Security Advisory: .NET 5.0 on Red Hat Enterprise Linux security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2021:1547 Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- ELSA-2021-2037 Important: dotnet3.1 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 29, 2021
- ELSA-2021-2036 Important: dotnet5.0 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 29, 2021
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31204
- FEDORA-2021-a3c205f5b2 vendor-advisory
- FEDORA-2021-13e3bd248f vendor-advisory
- FEDORA-2021-721731dc86 vendor-advisory
- FEDORA-2021-c06b64b5ee vendor-advisory
- FEDORA-2021-f25eb9e302 vendor-advisory
- FEDORA-2021-d551431950 vendor-advisory